Recon
Expand recon scope to acquired companies
Pull acquired companies for a parent domain from SecurityTrails.
overview
What get-acq does
get-acq takes a parent domain file (--domains) and a SecurityTrails API key (-a), calls the acquisitions endpoint, and returns acquired companies as JSON. That list often includes subsidiaries missing from the parent's own inventory.
Acquisitions widen scope before enumeration. A company bought last year still owns root domains, certificates, and services that may lag the parent's baseline. Listing them first keeps later discovery honest.
Run it early in recon, then hand acquired domains from the file and folder output into subdomain enumeration.
use cases
Where get-acq fits
Map a company's full acquisition footprint
Point get-acq at a parent domain to pull the companies it has acquired, surfacing subsidiaries whose infrastructure rarely shows up in the parent's own asset inventory.
Widen recon scope before enumeration
Run get-acq first to establish the real corporate boundary, then pass the acquired companies into subdomain discovery so nothing owned by the target gets skipped.
Find the weak link in a corporate estate
Recently acquired companies often lag behind the parent's security baseline. Listing them early points testing at the assets most likely to be under-monitored.
Automate acquisition monitoring
Schedule get-acq in a workflow so newly recorded acquisitions surface on their own, then chain the output into subfinder so each new company flows straight into enumeration.
reference
get-acq inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain-names | FILE | --domains | File with the list of parent domains to look up acquisitions for. |
| security-trails-apikey | STRING | -a | SecurityTrails API key used to authenticate the lookup. |
Showing key inputs. get-acq exposes 2 inputs in total.
example
Run get-acq
# list the companies a target has acquired via SecurityTrailspython3 get-acq.py --domains domains.txt -a "$SECURITYTRAILS_API_KEY" -o acquisitions.json{ "endpoint": "/v1/domain/example.com/acquisitions", "acquisitions": [ "example.net", "example.org", "example.io", "example.dev", "example.app" ]}guidance
Choosing get-acq
Use at the start of recon when you need the companies a target acquired before enumerating hostnames. Pair with amass-intel for root domains and subfinder for subdomains; this node only does the acquisition lookup.
amass-intel
Finds an organization's root domains and network ranges via ASN, CIDR, and reverse whois. Broader org discovery, no acquisition list.
whoisninja
Reverse WHOIS lookup. Finds domains registered to the same entity, a different relationship than corporate acquisitions.
whois-with-ripe
Pulls WHOIS data through ripe.net. Useful for registration detail once you have the domains get-acq surfaces.
faq
get-acq questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run get-acq yourself
A file of parent domains feeds get-acq, which lists the companies the target acquired and hands them to subfinder for subdomain enumeration before they land as a queryable output.
Facts on this page come from the live Trickest tool library.